The Internet has emerged as a critical communication infrastructure, carrying traffic for a wide range of important scientific, business and consumer applications. Since Internet services are becoming ubiquitous, more and more businesses and consumers are relying on their Internet connections for both voice and data transport needs. Each component of the network is shared by a large number of businesses and consumers and needs to meet a variety of service quality expectations. For example, network service providers and enterprise network operators need to monitor the network for security purposes. Large volume of network data is gathered to identify relevant events for analysis. However, the volume of traffic is constantly changing. In addition, some traffic types represent much larger proportion of the packets traversing the network. Security events don't always affect all traffic types in the same way or to the same extent. For example, network worms can cause a significant increase in communication attempts and generally a lesser increase in the number of bytes transported. This type of security event may be more significant in terms of impact on the customers and may not be large enough to register in an overall traffic volume measurement.
Therefore, there is a need for a method that provides a traffic composite graph that provides relative size of an event in relation to other traffic activity and expected traffic activity volumes.